# Blinder Tunnel Campaign Targets Iraqi Infrastructure

Iranian actor sent a trojanized Visual Studio C# project to an Iraqi engineer; a hijacked GetFrameworkPaths MSBuild target auto-ran on project load, leading to AppDomainManager hijack, DLL sideloading and Chisel tunneling.

- Payout: Real-world hack
- Severity: high
- Program: Iraqi critical infrastructure
- Analysis by: Unit 42
- Disclosed: 2026-10-06
- Write-up quality: 8/10
- Original: https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-blinder-tunnel-targets-critical-infrastructure
- Tags: area:os domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:dotnet tech:github-actions tech:windows technique:chained technique:source-review vuln:rce

**Target:** Visual Studio C# project (.csproj) / MSBuild design-time build
**Root cause:** The malicious .csproj defined a custom XML target named GetFrameworkPaths, overriding Microsoft's default, so Visual Studio's background design-time build executed attacker instructions on project load without user action.
**Steps:**
1. Deliver `DubaiAirport_Carrers_IT_Test.zip` posing as a Dubai Airports coding assessment with a Readme instructing the target to open/build the C# project.
2. In the .csproj, define a custom XML target named `GetFrameworkPaths` that overrides the default.
3. On project open, Visual Studio's design-time build runs GetFrameworkPaths and executes the attacker's script.
4. Script creates `%LOCALAPPDATA%\Microsoft\RuntimeBrokers`, copies hidden binaries from the project's Resources folder, and launches `RuntimeBroker.exe`.
5. MSBuild launches signed `vshost.exe` renamed to `RuntimeBroker.exe`; `RuntimeBroker.exe.config` replaces the AppDomainManager with a malicious one and sets `<etwEnable enabled="false"/>`.
6. `RuntimeBroker.exe` sideloads `RuntimeBroker.dll` (ShelbyLoader V2), which persists via `HKCU\...\Run\MicrosoftRuntime` and beacons to GitHub repo `peakyblinders-tm/myLic` using a hard-coded PAT.
7. Loader decrypts `RuntimeBrokerApi.dll` (ShelbyC2 V2) using SHA-256 of the license content as key; commands run via PsProxy.dll in-memory PowerShell runspace.
8. Blackwood.dll (from `pubs/Client.zip`) sideloaded via `vshost32.exe` decrypts an embedded Chisel DLL and connects to `91.107.156[.]29` with `R:0.0.0.0:10999:socks`.
**How found:** Unit 42 identified the campaign via VirusTotal submissions from an Iraq-based submitter, then analyzed the archive, .csproj, config files and malware samples to reconstruct the chain.
**Exploitation:** Social engineering as Dubai Airports recruiters delivered a decoy career portal then a weaponized coding challenge; opening the project auto-executed the chain, giving the actor a GitHub-C2 RAT and a reverse SOCKS5 Chisel tunnel for lateral pivoting inside the victim network.
**Escalation:** Chained .csproj proxy execution to AppDomainManager hijack (ETW disabled) to DLL sideloading, then deployed a zero-disk Chisel tunnel to pivot into internal networks.
**Insight:** Developer tooling is an execution surface: MSBuild design-time targets like GetFrameworkPaths run on project open before any build, so a weaponized .csproj plus a renamed signed host with a tampered .config yields code execution with no macro or click.

## Proof of concept (copied exactly from the original report)

**Malicious .csproj GetFrameworkPaths target**

```
the attackers defined a custom XML target with this exact name in their malicious .csproj file, overriding the safe Microsoft default behavior.

When the target opened the project, Visual Studio attempted its routine background check and executed the attacker's custom instructions without user intervention. The script created a deceptive folder in the user's local app data: %LOCALAPPDATA%\Microsoft\RuntimeBrokers. It then copied the hidden malware binaries from the project's Resources folder to this directory and launched the payload, RuntimeBroker.exe.
```

**AppDomainManager config disabling ETW**

```
By adding just a few lines of XML, the attacker instructed the system to disable one of its security-tracking mechanisms using the <etwEnable enabled="false"/> directive.
```

**Blackwood Chisel config decryption key**

```
If the loader binary had a DLL extension, the loader treated the configuration file as Base64-encoded text and decrypted the file via the RC4 algorithm using the hard-coded key “My name is Blackwood !”
```